tor

commit 7787150521fda0370331dab80d043294e05e1598
parent 3a2b5a5bcbb35cdedfb63a00391bbf15df69cd9b
Author: Nick Mathewson <nickm@torproject.org>
Date:   Wed,  8 Aug 2018 09:26:23 -0400

Merge branch 'maint-0.3.4'

Diffstat:
A
changes/bug25440
 | 
5
+++++
M
src/lib/sandbox/sandbox.c
 | 
2
+-

2 files changed, 6 insertions(+), 1 deletion(-)
diff --git a/changes/bug25440 b/changes/bug25440
@@ -0,0 +1,5 @@
+  o Minor bugfixes (linux seccomp2 sandbox):
+    - Fix a bug in out sandboxing rules for the openat() syscall.
+      Previously, no openat() call would be permitted, which would break
+      filesystem operations on recent glibc versions. Fixes bug 25440;
+      bugfix on 0.2.9.15. Diagnosis and patch from Daniel Pinto.
diff --git a/src/lib/sandbox/sandbox.c b/src/lib/sandbox/sandbox.c
@@ -455,7 +455,7 @@ allow_file_open(scmp_filter_ctx ctx, int use_openat, const char *file)
 {
   if (use_openat) {
     return seccomp_rule_add_2(ctx, SCMP_ACT_ALLOW, SCMP_SYS(openat),
-                              SCMP_CMP_STR(0, SCMP_CMP_EQ, AT_FDCWD),
+                              SCMP_CMP(0, SCMP_CMP_EQ, (unsigned int)AT_FDCWD),
                               SCMP_CMP_STR(1, SCMP_CMP_EQ, file));
   } else {
     return seccomp_rule_add_1(ctx, SCMP_ACT_ALLOW, SCMP_SYS(open),